Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it claims by creating ClickUp tickets, but it gives an agent broad ticket-creation authority with weak activation and credential-handling safeguards.
Install only if you are comfortable letting the agent create real ClickUp tasks with your API token. Use a least-privileged ClickUp token if possible, prefer temporary or secret-manager based credential handling over shell rc files, avoid putting secrets or sensitive infrastructure details in ticket text, and require an explicit confirmation before the agent runs the command.
clup.sh:139Unescaped User Input Allows JSON Payload Injection
clup.sh:161ClickUp API Token Is Exposed Through Curl Process Arguments
The skill description claims constrained behavior and quality enforcement, but the actual behavior implies use of shell execution and ClickUp API credentials without declaring those permissions or validating the promised 2-3 sentence minimum. This mismatch can mislead reviewers and users about what the skill actually does, causing unexpected network actions and secret use under a seemingly simple ticket-formatting skill. The skill context increases risk because it can transform vague prompts into real external side effects against a production task system.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
./clup.sh --title "Test" --description "Testing the tool"
sudo ln -s "$(pwd)/clup.sh" /usr/local/bin/clup
The examples explicitly include sensitive internal details such as hostnames, private IPs, ports, outage timing, and production system names, but the documentation does not warn that these descriptions are sent to a third-party service. This creates a realistic risk of oversharing confidential infrastructure and incident data through routine ticket creation.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
{"status":"error","http_code":400,"message":"Failed to create ticket"}
The README encourages very broad natural-language invocation such as 'Create ticket for...' and 'Just say "Create ticket for..."', which can overlap with ordinary conversation and make an agent invoke the skill without sufficiently explicit user intent. In an agent setting, this increases the chance of unintended external actions and accidental transmission of operational details into ClickUp.
The skill advertises shell-based execution but does not declare any tool scope such as allowed-tools or permissions. That omission weakens containment and review because a task-creation skill can invoke local commands and potentially use sensitive environment variables without explicit authorization boundaries. In this context, the lack of scoping is more dangerous because the skill is intended to trigger from common natural-language requests and relies on API credentials.
The trigger phrases are broad enough to match generic productivity language such as reminders or task creation requests that may not be intended for ClickUp. This can cause unintended invocation and external ticket creation, especially when combined with shell execution and API-backed side effects. In a skill that creates real objects in a third-party system, accidental activation is more dangerous than in a read-only or advisory skill.
The script instructs users to persist the ClickUp API key in shell startup files like ~/.zshrc or ~/.bashrc. Storing long-lived secrets in plaintext config files increases exposure to local compromise, accidental disclosure via backups/dotfile sync, or inadvertent sharing.
echo -e "${YELLOW}Please set your ClickUp API key:${NC}" >&2
echo -e " ${GREEN}export CLICKUP_API_KEY=\"pk_your_api_key_here\"${NC}" >&2
echo "" >&2
echo "To make it permanent, add to ~/.zshrc or ~/.bashrc:" >&2
echo -e " ${GREEN}echo 'export CLICKUP_API_KEY=\"pk_xxx\"' >> ~/.zshrc${NC}" >&2
echo "" >&2
echo "Get your API key: ClickUp Settings → Apps → Generate API Token" >&2
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo -e "${YELLOW}Please set your ClickUp List ID:${NC}" >&2
echo -e " ${GREEN}export CLICKUP_DEFAULT_LIST_ID=\"123456789\"${NC}" >&2
echo "" >&2
echo "To make it permanent, add to ~/.zshrc or ~/.bashrc:" >&2
echo -e " ${GREEN}echo 'export CLICKUP_DEFAULT_LIST_ID=\"xxx\"' >> ~/.zshrc${NC}" >&2
echo "" >&2
echo "Find your List ID in the ClickUp URL:" >&2
This shell script sends the provided title, description, tags, and status to the external ClickUp API using the user's API key. While the script's purpose implies ticket creation, the code does not include a direct user-facing notice at the point of transmission that task contents are sent to a third-party service.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
fi
# Make API request
response=$(curl -s -w "\n%{http_code}" -X POST \
"https://api.clickup.com/api/v2/list/${CLICKUP_DEFAULT_LIST_ID}/task" \
-H "Authorization: ${CLICKUP_API_KEY}" \
-H "Content-Type: application/json" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Make API request
response=$(curl -s -w "\n%{http_code}" -X POST \
"https://api.clickup.com/api/v2/list/${CLICKUP_DEFAULT_LIST_ID}/task" \
-H "Authorization: ${CLICKUP_API_KEY}" \
-H "Content-Type: application/json" \
-d "$JSON_PAYLOAD")